Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger researcher James Kettle presented a paper at Black Hat USA and DEF CON on web timing attacks, validated on a test bed of 30,000 live websites drawn from bug bounty programs via bbscope and Rapid7's Project Sonar DNS database. The paper details...
PortSwigger released Burp Suite Professional and Community version 2024.7.2 on 7 August 2024 at 21:00 UTC, updating the default Intruder payload list to include email splitting attacks. The release points to the white paper "Splitting the Email Atom:...
PortSwigger released Burp Suite Professional and Community 2024.6.5 on 7 August 2024, updating the default Intruder payload list to include email splitting attacks. The release points to the white paper "Splitting the Email Atom: Exploiting Parsers to...
PortSwigger researcher Gareth Heyes showed that email parsing discrepancies can be turned into access control bypasses and even RCE, exploiting RFC features like quoted values, escapes, comments, and encoded-word to make parsers disagree about an address's...
PortSwigger researchers published a paper showing that popular CDNs and origin servers parse URLs differently, using different delimiter characters and inconsistent decoding and dot-segment normalization, which enables arbitrary web cache poisoning and web...
PortSwigger released Burp Suite Professional and Community 2024.6.6 as a stable release on Monday, 12 August 2024 at 15:09 UTC. The release upgrades Burp's browser to Chromium 127.0.6533.100 for Windows and Mac and 127.0.6533.99 for Linux. What's...
PortSwigger released Burp Suite Professional and Community 2024.7.3 as an Early Adopter release on Monday, 12 August 2024. The release upgrades Burp's browser to Chromium 127.0.6533.100 for Windows and Mac and 127.0.6533.99 for Linux. What's compelling:...
PortSwigger released Burp Suite Professional and Community 2024.7.4 as an Early Adopter build on Wednesday, 21 August 2024. The release fixes bugs including the Proxy > Intercept table failing to select the next message after dropping or forwarding,...
At Black Hat USA, PortSwigger Research presented three releases: James Kettle's web timing attack techniques, Gareth Heyes's email parser exploitation for access control bypass and RCE, and Martin Doyhenard's web cache poisoning and deception via URL...
PortSwigger released Burp Suite Enterprise Edition 2024.8 on 27 August 2024, adding endpoint configuration for API scanning that lets users select or deselect endpoints, search them, and filter by HTTP method from a new Endpoints tab. The release also adds...
PortSwigger released Burp Suite Professional/Community 2024.7.5 on 30 August 2024, adding performance upgrades for large responses and Repeater-heavy project files, a reworked Intercept feature that lists messages in send order with bulk edit, forward, and...
PortSwigger released Burp Suite Professional and Community 2024.8 on 30 August 2024, adding the ability to manually create issues for vulnerabilities found during penetration testing and a built-in test function for match and replace rules. The release...
PortSwigger researcher @zakfedotkin published a URL Validation Bypass Cheat Sheet on 3 September 2024, an interactive web application that consolidates known payloads for exploiting URL parsing discrepancies. The tool offers three contexts, six payload...
PortSwigger's BApp Store lists Padding Oracle Hunter, a Burp Suite extension by GovTech-CSG at version 1.2, last updated 10 September 2024, that helps penetration testers identify and exploit the PKCS#7 and PKCS#1 v1.5 padding oracle vulnerability. The...
PortSwigger reworked Burp Suite's table sorting so that sorting large project files no longer triggers repeated slow disk retrievals or freezes the UI thread, with multi-column sorts previously requiring up to two to three times more data retrievals. It...
PortSwigger released a performance update to Burp Suite that speeds up table sorting from minutes to seconds, loads large project files faster even with many Repeater tabs, and cuts memory usage in Intruder. Sitemap filtering that could take hours now...
PortSwigger released Burp Suite Professional and Community 2024.7.6 on Thursday, 12 September 2024, a stable update that upgrades Burp's embedded browser to Chromium 128.0.6613.119 on Windows, Mac, and Linux. The release also fixes two bugs: messages...
PortSwigger released Burp Suite Professional and Community 2024.8.1 as an Early Adopter build on Friday, 13 September 2024, upgrading Burp's browser to Chromium 128.0.6613.119 on Windows, Mac, and Linux. The release fixes three bugs: messages becoming...
PortSwigger released Burp Suite Enterprise Edition 2024.9 on 17 September 2024, adding two issue management features: accepted risk marking and severity adjustment. The release also lets users leave notes recording why each decision was made, which...
PortSwigger's BApp Store lists a Burp Suite extension called Display Switcher, version 1.0.1, by Karl S of White Oak Security, last updated 20 September 2024. The extension adds a context menu item in Burp Suite that switches between defined Display...
PortSwigger's BApp Store lists the JSON Escaper, a Burp Suite plugin by Akash C at version 1.3, last updated 24 September 2024, that escapes JSON payloads for pentesters instead of manual escaping. The plugin takes a payload, escapes it, and displays the...
PortSwigger Research surveyed AppSec and penetration testing professionals in a webinar on Burp Suite Enterprise Edition's API scanning features and grouped their pain points into six themes, led by a lack of API visibility and difficulty discovering...
PortSwigger released Burp Suite Professional and Community 2024.8.2 on 1 October 2024, adding the ability to manually create issues for vulnerabilities found during penetration testing, a built-in test function for match and replace rules, a new Proxy >...
PortSwigger released Burp Suite Professional/Community 2024.9 on 1 October 2024, adding a redesigned Burp Intruder side panel for editing payload positions, payloads, and attack settings without switching tabs. The release also adds Bambda-based HTTP match...
PortSwigger Research describes a Burp Suite extension called Look Over There, created by Felix Ryan, that takes a trigger URI and a target URI and, when the trigger URI is observed, inserts an HTTP 302 status code and a Location header pointing to the...
PortSwigger released Burp Suite Professional and Community 2024.8.3 as a stable build on Monday, 7 October 2024 at 12:09 UTC. The release upgrades Burp's embedded browser to Chromium 129.0.6668.71 on Windows and Mac and 129.0.6668.70 on Linux. What's...
PortSwigger released Burp Suite Professional and Community 2024.9.1 as an Early Adopter build on Monday, 7 October 2024, upgrading Burp's embedded browser to Chromium 129.0.6668.71 on Windows and Mac and 129.0.6668.70 on Linux. The release is available as...
PortSwigger released Burp Suite Professional and Community 2024.8.4 as a stable version on Tuesday, 8 October 2024 at 13:06 UTC, with downloads for JAR, Linux (ARM and x64), macOS (Apple silicon and Intel), and Windows (ARM and x64). The release fixed an...
Doyensec released version 1.0 of the Prototype Pollution Gadgets Finder, a Burp Suite extension that automates scanning of requests to detect and analyze server-side prototype pollution vulnerabilities in web applications. The tool exploits known gadgets,...
PortSwigger released Burp Suite Professional and Community 2024.8.5 as a stable build on Monday, 14 October 2024 at 16:21 UTC. The release fixes a bug where project files were sometimes incorrectly saved to the working directory, so a project previously...